hxxps://cdn[.]discordapp[.]com/attachments/1214605780129550376/1216479047299764305/fivemprivatestrafe[.]zip?ex=66008965&is=65ee1465&hm=f787042a5a0baaf96d40af5550f054ae45d2e1fa1c4097b342f8ef9ec13778d7&

Resubmissions

11/03/2024, 06:29

240311-g8wphadh68 1

11/03/2024, 06:20

240311-g3qajadg28 7

11/03/2024, 06:15

240311-gz3rfseb2t 7

Analysis

max time kernel
274s
max time network
295s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11/03/2024, 06:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://cdn.discordapp.com/attachments/1214605780129550376/1216479047299764305/fivemprivatestrafe.zip?ex=66008965&is=65ee1465&hm=f787042a5a0baaf96d40af5550f054ae45d2e1fa1c4097b342f8ef9ec13778d7&

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1904519900-954640453-4250331663-1000\{7F6A6638-AC0B-4238-A076-751EAE310685}	msedge.exe

Opens file in notepad (likely ransom note) 6 IoCs

ransomware

pid	Process
4016	notepad.exe
5052	notepad.exe
3188	NOTEPAD.EXE
2004	notepad.exe
4448	notepad.exe
532	notepad.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1700	msedge.exe
1700	msedge.exe
2044	msedge.exe
2044	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	2668	7zG.exe
Token: 35	2668	7zG.exe
Token: SeSecurityPrivilege	2668	7zG.exe
Token: SeSecurityPrivilege	2668	7zG.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2668	7zG.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 1420	1700	msedge.exe	118
PID 1700 wrote to memory of 1420	1700	msedge.exe	118
PID 1700 wrote to memory of 4476	1700	msedge.exe	119
PID 1700 wrote to memory of 4476	1700	msedge.exe	119
PID 1700 wrote to memory of 4476	1700	msedge.exe	119
PID 1700 wrote to memory of 4476	1700	msedge.exe	119
PID 1700 wrote to memory of 4476	1700	msedge.exe	119
PID 1700 wrote to memory of 4476	1700	msedge.exe	119
PID 1700 wrote to memory of 4476	1700	msedge.exe	119
PID 1700 wrote to memory of 4476	1700	msedge.exe	119
PID 1700 wrote to memory of 4476	1700	msedge.exe	119
PID 1700 wrote to memory of 4476	1700	msedge.exe	119
PID 1700 wrote to memory of 4476	1700	msedge.exe	119
PID 1700 wrote to memory of 4476	1700	msedge.exe	119
PID 1700 wrote to memory of 4476	1700	msedge.exe	119
PID 1700 wrote to memory of 4476	1700	msedge.exe	119
PID 1700 wrote to memory of 4476	1700	msedge.exe	119
PID 1700 wrote to memory of 4476	1700	msedge.exe	119
PID 1700 wrote to memory of 4476	1700	msedge.exe	119
PID 1700 wrote to memory of 4476	1700	msedge.exe	119
PID 1700 wrote to memory of 4476	1700	msedge.exe	119
PID 1700 wrote to memory of 4476	1700	msedge.exe	119
PID 1700 wrote to memory of 4476	1700	msedge.exe	119
PID 1700 wrote to memory of 4476	1700	msedge.exe	119
PID 1700 wrote to memory of 4476	1700	msedge.exe	119
PID 1700 wrote to memory of 4476	1700	msedge.exe	119
PID 1700 wrote to memory of 4476	1700	msedge.exe	119
PID 1700 wrote to memory of 4476	1700	msedge.exe	119
PID 1700 wrote to memory of 4476	1700	msedge.exe	119
PID 1700 wrote to memory of 4476	1700	msedge.exe	119
PID 1700 wrote to memory of 4476	1700	msedge.exe	119
PID 1700 wrote to memory of 4476	1700	msedge.exe	119
PID 1700 wrote to memory of 4476	1700	msedge.exe	119
PID 1700 wrote to memory of 4476	1700	msedge.exe	119
PID 1700 wrote to memory of 4476	1700	msedge.exe	119
PID 1700 wrote to memory of 4476	1700	msedge.exe	119
PID 1700 wrote to memory of 4476	1700	msedge.exe	119
PID 1700 wrote to memory of 4476	1700	msedge.exe	119
PID 1700 wrote to memory of 4476	1700	msedge.exe	119
PID 1700 wrote to memory of 4476	1700	msedge.exe	119
PID 1700 wrote to memory of 4476	1700	msedge.exe	119
PID 1700 wrote to memory of 4476	1700	msedge.exe	119
PID 1700 wrote to memory of 4476	1700	msedge.exe	119
PID 1700 wrote to memory of 4476	1700	msedge.exe	119
PID 1700 wrote to memory of 4476	1700	msedge.exe	119
PID 1700 wrote to memory of 4476	1700	msedge.exe	119
PID 1700 wrote to memory of 4476	1700	msedge.exe	119
PID 1700 wrote to memory of 4476	1700	msedge.exe	119
PID 1700 wrote to memory of 4476	1700	msedge.exe	119
PID 1700 wrote to memory of 4476	1700	msedge.exe	119
PID 1700 wrote to memory of 4476	1700	msedge.exe	119
PID 1700 wrote to memory of 4476	1700	msedge.exe	119
PID 1700 wrote to memory of 4476	1700	msedge.exe	119
PID 1700 wrote to memory of 3432	1700	msedge.exe	120
PID 1700 wrote to memory of 3432	1700	msedge.exe	120
PID 1700 wrote to memory of 4500	1700	msedge.exe	121
PID 1700 wrote to memory of 4500	1700	msedge.exe	121
PID 1700 wrote to memory of 4500	1700	msedge.exe	121
PID 1700 wrote to memory of 4500	1700	msedge.exe	121
PID 1700 wrote to memory of 4500	1700	msedge.exe	121
PID 1700 wrote to memory of 4500	1700	msedge.exe	121
PID 1700 wrote to memory of 4500	1700	msedge.exe	121
PID 1700 wrote to memory of 4500	1700	msedge.exe	121
PID 1700 wrote to memory of 4500	1700	msedge.exe	121

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cdn.discordapp.com/attachments/1214605780129550376/1216479047299764305/fivemprivatestrafe.zip?ex=66008965&is=65ee1465&hm=f787042a5a0baaf96d40af5550f054ae45d2e1fa1c4097b342f8ef9ec13778d7&
1⤵
PID:448

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --mojo-platform-channel-handle=5244 --field-trial-handle=2232,i,11267738607351977302,107266978269557304,262144 --variations-seed-version /prefetch:1
1⤵
PID:2128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --mojo-platform-channel-handle=5716 --field-trial-handle=2232,i,11267738607351977302,107266978269557304,262144 --variations-seed-version /prefetch:1
1⤵
PID:2112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5788 --field-trial-handle=2232,i,11267738607351977302,107266978269557304,262144 --variations-seed-version /prefetch:8
1⤵
PID:3720

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --no-appcompat-clear --mojo-platform-channel-handle=5436 --field-trial-handle=2232,i,11267738607351977302,107266978269557304,262144 --variations-seed-version /prefetch:8
1⤵
PID:488

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --mojo-platform-channel-handle=4848 --field-trial-handle=2232,i,11267738607351977302,107266978269557304,262144 --variations-seed-version /prefetch:1
1⤵
PID:2876

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --mojo-platform-channel-handle=6164 --field-trial-handle=2232,i,11267738607351977302,107266978269557304,262144 --variations-seed-version /prefetch:1
1⤵
PID:3436

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5924 --field-trial-handle=2232,i,11267738607351977302,107266978269557304,262144 --variations-seed-version /prefetch:8
1⤵
PID:3392

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=6748 --field-trial-handle=2232,i,11267738607351977302,107266978269557304,262144 --variations-seed-version /prefetch:8
1⤵
PID:4920

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4824 --field-trial-handle=2232,i,11267738607351977302,107266978269557304,262144 --variations-seed-version /prefetch:8
1⤵
PID:3620

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1996

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.52 --initial-client-data=0x240,0x244,0x248,0x23c,0x214,0x7ffcccf42e98,0x7ffcccf42ea4,0x7ffcccf42eb0
  2⤵
  PID:1420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=3020 --field-trial-handle=3024,i,11830284525638360536,18244994823401854768,262144 --variations-seed-version /prefetch:2
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=3304 --field-trial-handle=3024,i,11830284525638360536,18244994823401854768,262144 --variations-seed-version /prefetch:3
  2⤵
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=3408 --field-trial-handle=3024,i,11830284525638360536,18244994823401854768,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4400 --field-trial-handle=3024,i,11830284525638360536,18244994823401854768,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4400 --field-trial-handle=3024,i,11830284525638360536,18244994823401854768,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4452 --field-trial-handle=3024,i,11830284525638360536,18244994823401854768,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4636 --field-trial-handle=3024,i,11830284525638360536,18244994823401854768,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:1872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4592 --field-trial-handle=3024,i,11830284525638360536,18244994823401854768,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4596 --field-trial-handle=3024,i,11830284525638360536,18244994823401854768,262144 --variations-seed-version /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3724 --field-trial-handle=3024,i,11830284525638360536,18244994823401854768,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:4032

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\fivemprivatestrafe\" -ad -an -ai#7zMap22705:94:7zEvent28990
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2668

C:\Windows\system32\notepad.exe
"C:\Windows\system32\notepad.exe" "C:\Users\Admin\Desktop\fivemprivatestrafe\strafe.reg"
1⤵
- Opens file in notepad (likely ransom note)
PID:2004

C:\Windows\system32\notepad.exe
"C:\Windows\system32\notepad.exe" "C:\Users\Admin\Desktop\fivemprivatestrafe\strafe2.reg"
1⤵
- Opens file in notepad (likely ransom note)
PID:4448

C:\Windows\system32\notepad.exe
"C:\Windows\system32\notepad.exe" "C:\Users\Admin\Desktop\fivemprivatestrafe\strafe3.reg"
1⤵
- Opens file in notepad (likely ransom note)
PID:532

C:\Windows\system32\notepad.exe
"C:\Windows\system32\notepad.exe" "C:\Users\Admin\Desktop\fivemprivatestrafe\strafe5.reg"
1⤵
- Opens file in notepad (likely ransom note)
PID:4016

C:\Windows\system32\notepad.exe
"C:\Windows\system32\notepad.exe" "C:\Users\Admin\Desktop\fivemprivatestrafe\strfae4.reg"
1⤵
- Opens file in notepad (likely ransom note)
PID:5052

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\fivemprivatestrafe\x.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:3188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
954bb07086efeb8e0ce5d0a69108d700

SHA1
7aabee2b1c30903708d3aa7e549ec0b2399226c2

SHA256
c0e086a6082d28e37eacbeb4e61793cd8f90ce190594d8456d874b287cfb2889

SHA512
94d7d3d9db96b48225dcc40fb5c6ad446c0583a902f4aafb725fe2108fb4f53f7f6bbc1a3861cfed56397c002fce3bd1ea33729bcc851adb67cb8bbaf50ce302

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
5a53b8e316f25906f585943066245dbc

SHA1
710f1fc23671de3408d85b29ed9e9e6bac837b09

SHA256
5e5d5d5a0ad1225f8c602aa967ec34184458ee485ba9cfdf7357ceb4bdabb602

SHA512
860ec823c7619518a0a0490322a282514ccd37c0ec9d92a7bce07ee5f5d4bec78d9ff0452879a1748c76fafecca43ca9c502444c4baa49aaf5dfae358d1e3ca2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
1edc4a7ee453555f4a6bc913180b4618

SHA1
a18802ad1536bfc7485875c01b9a31e33ff6c401

SHA256
7e3d50ef59b38e2f834ee2b011683ac17ae2652019be1a2c2eaac43c1aab8c3b

SHA512
2e704347aa56830ad4fbee519ac8d00f86a91be39f5211161406c3627d63d5c28f77749640c09bb1155c2f7bbe3e8e254b2a20960910dcd2e54bd6827e4106d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
30KB

MD5
f0a00959b6173bf79a4e0f4ccf3fedca

SHA1
341c12e6d4066cb4c87bccc83f33095d6d743f10

SHA256
30fe952eab9215556722e91b494c7e1c1c7d318fc36b429fd04594778695bf8a

SHA512
3ea75c60ff9eef5671bce31f93bd9f56dabac6fe86da32dd8d05df8e28518e7b651c141535b16a20e55424060b577d84011d63c78bf03aceaa4ec086276c78a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
59KB

MD5
a544607dcd08af3931d05f88c6c803b2

SHA1
7ef13c893c25dd9a1ffe3f39a5edeea810cc89bb

SHA256
def88bc1846ba8f765310776e50c4016d8c35022a863076622511c31858a5866

SHA512
4892e901be5271ccf44c1fc5478f68426efe28353650b3f42edca70899b5a64cb6ca9f4a3e6ba8ccc4a86e0a65c6e42ab7ae6b79806f6a1fefd94a78d52e1dee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
69KB

MD5
9e4a74382f6d3ed24dbdcfa8fcd5eff1

SHA1
f69e891b0a70375d23832537d478e1481a720c2c

SHA256
d45e77c1e7290d6dc4dc643a55310200fb0f99765fdfe8350f7b01209dc222e5

SHA512
08258485d62df7a2aea8127cd286a265365459fa3ded767ba2e2442aeac2040887ff85a3f1d69d3e84bb50e33fe1e1572afd9348d3bf361d02e892229f7c42ed

Download Submit
C:\Users\Admin\Desktop\fivemprivatestrafe\strafe.reg

Filesize
858B

MD5
2a3715c6db552047f82bb10cf18fc842

SHA1
0422a38dc11e6338e1cb9ee68f7839b2531b3bcf

SHA256
15a8184f9c803fdd194fd726610446364b63d37bc49251194612c5b74b6852fa

SHA512
66f4272c602b62dbc945903b079001e32f0c0418065b2cb5465a0da74d6be423343e92559038870c5a75a360f065e5f46c8985ba373d0a257abb3cc63fc4fef6

Download Submit
C:\Users\Admin\Desktop\fivemprivatestrafe\strafe2.reg

Filesize
866B

MD5
f76ed8ee7f06c8ff5bcd42e801c5021b

SHA1
50bf65818acff086ed41cae5d39afc3b3b2ea35f

SHA256
3daf34c7d2462949daf64967a22840c46a82a95f0ae8d34e1a52c8dac234a55c

SHA512
692a9025de580354f0c3513502f7159b34ad1b14c872e8679f8b978a212298858c2c4e5d8273bb4d91dadc31ec0e7ebbb94ba3292050432d12881cf8735c4aba

Download Submit
C:\Users\Admin\Desktop\fivemprivatestrafe\strafe3.reg

Filesize
878B

MD5
db618ca02f5e3358e016263a5a357395

SHA1
c27678d31ae36514ef2fbae36c51bc2b2e0b3734

SHA256
a9fa7eb1923e1802bee951f102fa7d201088c95e1f92822cadbddae4262cc033

SHA512
248e98c970a53d3cebd4a71565a509c4309edf159138adfa7653b659decd66958402ea138b27f395873038069408b7107008ab78923e2cc4dc01f0ac1c15d6b7

Download Submit
C:\Users\Admin\Desktop\fivemprivatestrafe\strafe5.reg

Filesize
874B

MD5
eecf711fc3141fec5e4c3a1cb4559acc

SHA1
15fd1e3240a97294849b3d709029f297192056a6

SHA256
0b5dd5a78be2260c67f0e033a9737a723f47208e9ff931b52cf4274621fda293

SHA512
d5c2b2351e1bc74dfb042f8181ade4f1aa7307f5df70e8805165ce87b2b3a099a86123e0d9ea31d207a658b575beb01908ea84eedce96d4eb972f10e62263862

Download Submit
C:\Users\Admin\Desktop\fivemprivatestrafe\strfae4.reg

Filesize
882B

MD5
9529466206abe4212da7b665028797cc

SHA1
eb15792d5d9e18620124d97396169a741951f985

SHA256
b6e92d97ae9e12574fc5d4d36654f388d42383375e09b164245b7b99c2855c92

SHA512
4463da0dfb0c06c9c4a4caddfbb2b4d44cb3ff891cd28040fd96fffc3c3e9e132f7ac56097930f965281923b8e03b34ea87976f454cdae4a09a8ff8cebb6f86e

Download Submit
C:\Users\Admin\Desktop\fivemprivatestrafe\x.txt

Filesize
66B

MD5
fca86def1295732cbd4ceb0502430786

SHA1
489b1d6dacbe4f9a95fae7cd9faac204291c566d

SHA256
0031e84d72f0e149b57cc545c1318123ab21c077fa396dcd6351ca4bd94fd691

SHA512
62a277db0b14f2e530cbf8dcb36040f1dcd7c7f5349d6f01158fc0dd9bbf987c190a68a354916a374883c8a197e5ea90b8e3ca122704e33df71a3fc1741378ad

Download Submit